e72f7aca561f2ac82e724b952c0a214658a394300deb097ff9257ca03969614c

Analysis

Target

WinRAR_184567342.exe
Size

3.0MB
MD5

0dbb338250c1ff34f1f74333e964a7eb
SHA1

3d338ed384362876af4d1072fd3f026ab808bc2a
SHA256

e72f7aca561f2ac82e724b952c0a214658a394300deb097ff9257ca03969614c
SHA512

e66db73c7b5aa87ae4bc9de8e6f9b0a3162caa68bf8d9a7d347297fffeab9920389d7b9643a9d292ec402bc5a303019aa17b36ba90efa12b805b24c5aa27227b

Score

10^/10

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

Processes:

WerFault.exe

description pid process target process

PID 4048 created 2388 4048 WerFault.exe WinRAR_184567342.exe
Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

1924 2388 WerFault.exe WinRAR_184567342.exe
4048 2388 WerFault.exe WinRAR_184567342.exe

description	pid	process	target process
PID 4048 created 2388	4048	WerFault.exe	WinRAR_184567342.exe

pid	pid_target	process	target process
1924	2388	WerFault.exe	WinRAR_184567342.exe
4048	2388	WerFault.exe	WinRAR_184567342.exe

Suspicious behavior: EnumeratesProcesses 28 IoCs

Processes:

WerFault.exeWerFault.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

WerFault.exeWerFault.exe

C:\Users\Admin\AppData\Local\Temp\WinRAR_184567342.exe
"C:\Users\Admin\AppData\Local\Temp\WinRAR_184567342.exe"
1⤵
PID:2388
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2388 -s 488
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1924
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2388 -s 480
  2⤵
  - Suspicious use of NtCreateProcessExOtherParentProcess
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4048

memory/2388-115-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2388-116-0x0000000002330000-0x00000000025A4000-memory.dmp

Filesize
2.5MB

Download
memory/2388-117-0x00000000025B0000-0x0000000002821000-memory.dmp

Filesize
2.4MB

Download
memory/2388-118-0x0000000002830000-0x0000000002AA2000-memory.dmp

Filesize
2.4MB

Download
memory/2388-122-0x0000000002830000-0x0000000002AA2000-memory.dmp

Filesize
2.4MB

Download
memory/2388-123-0x0000000002BB0000-0x0000000002E11000-memory.dmp

Filesize
2.4MB

Download